In the master configuration the provider is instantiated through a Buildbot service secret manager with the file directory path.
File secrets provider reads the file named by the key wanted by Buildbot and returns the contained text value (removing trailing newlines if present).
SecretInAFile provider allows Buildbot to read secrets in the secret directory.

In the master configuration, the provider is instantiated through a Buildbot service secret manager with the Vault token and the Vault server address.
Vault secrets provider accesses the Vault backend asking the key wanted by Buildbot and returns the contained text value.
SecretInVAult provider allows Buildbot to read secrets in the Vault.

Secrets are never visible to the normal user via logs and thus are transmitted directly to the workers, using Obfuscated.
The class Obfuscated replaces secret string value by #### characters when the secret value is logged.